problem with my comp

By works9
Dec 10, 2006
Topic Status:
Not open for further replies.
  1. hihi
    so i'm infected with something...i was getting help from another forum but they might have gave up on me or something....they told me that i need to fix

    O20 - Winlogon Notify: rpcc - C:\WINDOWS\System32\rpcc.dll
    O23 - Service: Application Layer Gateway Service (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
    O23 - Service: MS Software Shadow Download Provider (dnlsvc) - Unknown owner - C:\DOCUME~1\Dan\LOCALS~1\Temp\dnlsvc.exe (file missing)
    but i fix them and then when i do another scan, they appear again...i also can't delete the rpcc.dll from my system32 folder...can anyone help me from here?
  2. howard_hopkinso

    howard_hopkinso Newcomer, in training Posts: 25,948   +17

    Hello and welcome to Techspot.

    You have some nasty infections on your system.

    Go and read the Viruses/Spyware/Malware, preliminary removal instructions. Follow all the instructions exactly.

    Post fresh HJT and AVG Antispyware logs as attachments into this thread, only after doing the above.


    Regards Howard :wave: :wave:


    This thread is for the use of works9 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
  3. works9

    works9 Newcomer, in training Topic Starter

    ok, so i followed your instructions...the online scan didn't work (it closed on me while scanning) and Look2Me-Destroyer didn't work (it said it takes about a minute and then it appears back on, well it never did).
    spybot found HotsearchBar and Smitfraud-C. (it fixed 4 out of 5 problems, it could not fix C:\WINDOWS\System32|rpcc.dll
    ad-aware found a cookie and avg found nothing.
    here's a fresh avg log and HJT log.
  4. howard_hopkinso

    howard_hopkinso Newcomer, in training Posts: 25,948   +17

    Download the Pocket Killbox programme from HERE. Extract it but don`t run it yet.

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

    Turn off system restore.(XP/ME only) See how HERE.

    Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

    Click start/run and type services.msc into the run box and press the enter key.

    When the window appears, maximise it. Double click on the following services(if there) and select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

    MS Software Shadow Download Provider

    Close the services window.

    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    dnlsvc.exe

    Close task manager.

    Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    R3 - Default URLSearchHook is missing

    F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe

    O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.putfile.com/includes/ImageUploader4.cab

    O20 - Winlogon Notify: rpcc - C:\WINDOWS\System32\rpcc.dll

    O23 - Service: MS Software Shadow Download Provider (dnlsvc) - Unknown owner - C:\DOCUME~1\Dan\LOCALS~1\Temp\dnlsvc.exe (file missing)

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or directories(if there).

    C:\DOCUME~1\Dan\LOCALS~1\Temp\dnlsvc.exe

    Run the killbox.exe file. When it loads type the full path to the file you would like to delete in the field and check the delete file on reboot button. press the Delete File button (looks like a red circle with a white X). It will prompt you to reboot, select no until you have finished inputting the files you want to delete, only then allow it to reboot and hopefully your files will now be deleted. If your computer doesn`t automatically restart, restart it manually.

    This is the filepath you need to enter into killbox.

    C:\WINDOWS\System32\rpcc.dll

    Once your system has rebooted, turn system restore back on and rehide your protected OS files.

    Go HERE and download, install and run one of the antivirus programmes as per the instructions.

    You`re also running a completely unpatch version of Windows. You should run Windows updates and install at least service pack 1 and preferably service pack 2.

    Post a fresh HJT log and let me know how your system is running.

    Regards Howard :)

    This thread is for the use of works9 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
  5. works9

    works9 Newcomer, in training Topic Starter

    i don't think it worked because i still can't see any pictures when i open internet explorer...i could not turn off system restore (i'm running windows xp professional edition so, i can only be as an administrator in safe mode and i couldn't turn it off in safe mode)...i didn't find dnlsvc.exe, and i thought i deleted the rpcc.dll with killbox, but i guess not because i see it in this log.
  6. howard_hopkinso

    howard_hopkinso Newcomer, in training Posts: 25,948   +17

    Have HJT fix this inactive entry.

    O20 - Winlogon Notify: rpcc - C:\WINDOWS\System32\rpcc.dll (file missing)

    The above file has been deleted by killbox, hence the file missing in brackets.

    Delete the killbox backups.

    Other than that, your HJT log is clean.

    Update Windows and install an antivirus programme as I suggested.

    Install the latest versions of Flash player from HERE.

    Install the latest version of Java from HERE.

    Hopefully that`ll solve your image problems.

    If you have any further virus/spyware problems, please post in this thread.

    Regards Howard :)

    This thread is for the use of works9 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
  7. works9

    works9 Newcomer, in training Topic Starter

    ok, thanx for cleaning my computer, but i thought that if my comp was clean i could see pictures in IE (i included a screen shot so you can see what i see when i open go to google.com) is there a way to fix this...btw, i can't update my windows, i have the newest version of flash and java, and i have a anti-virus program.
  8. howard_hopkinso

    howard_hopkinso Newcomer, in training Posts: 25,948   +17

    What antivirus programme do you have?

    Also, try downloading and installing IE6 from HERE.

    See if that helps.

    Regards Howard :)

    This thread is for the use of works9 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
  9. works9

    works9 Newcomer, in training Topic Starter

    never mind, i fixed it...i'm so relieved that my computer is running perfect again...thank you howard_hopkinso, u own. thanx again.
  10. howard_hopkinso

    howard_hopkinso Newcomer, in training Posts: 25,948   +17

    What did you do to fix it?

    Regards Howard :)
  11. works9

    works9 Newcomer, in training Topic Starter

    i had to go in tools, internet options, advanced tab, go under Multimedia and select show pictures...that's it. i have no idea why it was unchecked in the first place. now the computer works just fine.
  12. howard_hopkinso

    howard_hopkinso Newcomer, in training Posts: 25,948   +17

    That`s good news.

    Regards Howard :)

    This thread is for the use of works9 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.